How do I set up BIMI? Is a VMC certificate always required?

Key findings

• Partial support: Some mailbox providers, such as Yahoo and Fastmail, support BIMI without a VMC, allowing for what is known as 'self-asserted' BIMI.
• Google's requirement: Google (Gmail) currently requires a VMC for a brand logo to be displayed via BIMI. This is a measure to enhance trust and prevent brand impersonation.
• Phishing prevention: The VMC acts as a security layer, verifying the authenticity of your brand logo and helping to combat phishing attacks by ensuring only legitimate, trademarked logos are displayed.
• DMARC prerequisite: Regardless of VMC status, a robust DMARC policy (at p=quarantine or p=reject) is a fundamental requirement for any BIMI implementation.

Key considerations

• Target audience: Consider which email clients your audience uses most. If Gmail users are a significant portion, a VMC is essential.
• Brand protection: While self-asserted BIMI exists, a VMC offers enhanced brand verification and trust, protecting your brand from impersonation. Learn more about the business value and ROI of BIMI.
• Implementation steps: Setting up BIMI involves several steps, including proper DMARC configuration and logo preparation. You can find detailed steps on how to implement BIMI.
• Cost implications: Obtaining a VMC involves costs, which should be factored into your BIMI strategy. Explore the pricing and approach behind VMC and BIMI.

Key opinions

• VMC is not universal: Many marketers note that BIMI can function on some platforms, like Yahoo and Fastmail, even without a VMC.
• Google's strictness: It is widely acknowledged that Google (Gmail) enforces a VMC requirement for BIMI logo display to ensure authenticity.
• Self-asserted BIMI: The concept of 'self-asserted' BIMI (without a VMC) is known and utilized, primarily for platforms that do not mandate VMCs.
• Brand trust: The VMC provides a strong verification layer, which marketers appreciate for building brand trust and preventing misuse of their logo for phishing.

Key considerations

• Client support: Marketers must understand which email clients support BIMI and whether they require a VMC. Learn about BIMI availability and requirements.
• Trademarking: Obtaining a VMC requires a trademarked logo, which is an important prerequisite for marketers to consider.
• Deliverability impact: While BIMI enhances branding, underlying email deliverability (reputation, inbox placement) remains critical for logo display. Good practices improve email deliverability rates.
• Testing: It is advisable to test BIMI setups thoroughly, even employing methods like cost-effective ways to test BIMI without immediate VMC investment where supported.

Key opinions

• Self-asserted BIMI defined: Experts explain that BIMI without a VMC is termed 'self-asserted' and involves a specific DNS record format.
• Declination option: The BIMI standard includes an option for 'declination to publish,' which allows senders to formally state they are aware of the protocol but choosing not to display a logo.
• VMC vs. Inbox placement: It is clarified that while a VMC addresses technical hurdles, the ultimate display of a BIMI logo depends on the sender's consistent inbox placement and overall reputation.
• No extra steps per provider: Experts confirm that there are generally no additional steps required with individual mailbox providers beyond good email deliverability practices to get a BIMI logo to display.

Key considerations

• DMARC enforcement: A DMARC policy of p=quarantine or p=reject is a foundational technical requirement for BIMI to work, ensuring proper email authentication. Understand the benefits of DMARC implementation.
• Mailbox provider discretion: Even with all technical aspects correctly configured (including a VMC), individual mailbox providers retain their own criteria for displaying a BIMI logo, influenced by sender reputation and other internal factors. For a comprehensive overview, see our guide on why emails fail.
• Graphics format: Ensure your logo is in the correct SVG format required for BIMI, whether self-asserted or VMC-verified.
• Security implications: The VMC requirement from providers like Google is a security measure to prevent phishing and brand impersonation, reinforcing trust in email communication. This is especially relevant given the rise of sophisticated phishing techniques.

Key findings

• DMARC foundation: The BIMI specification mandates a strong DMARC policy (p=quarantine or p=reject) as a prerequisite for logo display.
• Trademark requirement: To obtain a VMC, your brand logo must be registered as a trademark in a jurisdiction recognized by Certificate Authorities.
• SVG format: The logo used for BIMI must be in a specific Scalable Vector Graphics (SVG) format, specifically an SVG Tiny PS version.
• Certificate Authority (CA): VMCs are issued by trusted Certificate Authorities that have been accredited by the BIMI Group.

Key considerations

• Mailbox provider discretion: While documented requirements exist, the final decision to display a logo rests with each mailbox provider, often based on additional internal reputation metrics. You can implement BIMI for Gmail and Yahoo Mail with specific guidelines.
• BIMI record syntax: The BIMI DNS TXT record must follow a precise syntax, including the BIMI version and the URL to the SVG logo. Validating BIMI records and fixing errors is crucial.
• Logo verification: The VMC process involves a rigorous validation of your organization's identity and its ownership of the trademarked logo by the issuing Certificate Authority.
• Cost of VMC: Documentation on VMCs notes that there are costs associated with obtaining and maintaining the certificate, along with the overhead of trademark registration. This may influence the implementation of a VMC.